CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 0CVE-2020-24303 – grafana: XSS via a query alias for the Elasticsearch and Testdata datasource
https://notcve.org/view.php?id=CVE-2020-24303
28 Oct 2020 — Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. Grafana versiones anteriores a 7.1.0-beta 1, permite un ataque de tipo XSS por medio de un alias de consulta de la fuente de datos de ElasticSearch A flaw was found in grafana. A XSS via a query alias for the ElasticSearch datasource is allowed. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Issues addressed include bypass and cross site scripting vulnerab... • https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 37%CPEs: 1EXPL: 1CVE-2019-19499 – grafana: arbitrary file read via MySQL data source
https://notcve.org/view.php?id=CVE-2019-19499
28 Aug 2020 — Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations. Grafana versiones anteriores a 6.4.3 incluyéndola, presenta una vulnerabilidad de Lectura Arbitraria de Archivos, que podría ser explotada por un atacante autenticado que tiene privilegios para modificar las configuraciones de la fuente de datos Grafana has an Arbitrary File Read vulnerability, which could be exploited by an authentica... • https://security.netapp.com/advisory/ntap-20200918-0003 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 48%CPEs: 2EXPL: 1CVE-2020-11110 – grafana: stored XSS
https://notcve.org/view.php?id=CVE-2020-11110
27 Jul 2020 — Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot. Grafana hasta la versión 6.7.1 permite un ataque de tipo XSS almacenado debido a la insuficiente protección de entrada en el campo originalUrl, lo que permite a un atacante inyectar código JavaScript que se ejecutará después de hacer clic en Open Original Dashboard... • https://github.com/AVE-Stoik/CVE-2020-11110-Proof-of-Concept • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.2EPSS: 92%CPEs: 7EXPL: 5CVE-2020-13379 – Grafana 7.0.1 - Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2020-13379
03 Jun 2020 — The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault. La funcionalidad avatar en Grafana versiones 3.0.1 hasta 7.0.1, presenta un problema de Control de A... • https://packetstorm.news/files/id/158320 • CWE-476: NULL Pointer Dereference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18625
https://notcve.org/view.php?id=CVE-2018-18625
02 Jun 2020 — Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. Grafana versión 5.3.1, presenta una vulnerabilidad de tipo XSS por medio de un enlace en la pantalla "Dashboard ) All Panels ) General". NOTA: este problema se presenta debido a una corrección incompleta para CVE-2018-12099. • https://github.com/grafana/grafana/pull/11813 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18624 – grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen
https://notcve.org/view.php?id=CVE-2018-18624
02 Jun 2020 — Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. Grafana versión 5.3.1, presenta una vulnerabilidad de tipo XSS por medio de un estilo de columna en la pantalla "Dashboard ) Table Panel". NOTA: este problema se presenta debido a una corrección incompleta para CVE-2018-12099. A flaw was found in grafana. • https://github.com/grafana/grafana/pull/11813 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-18623 – grafana: XSS vulnerability via the "Dashboard > Text Panel" screen
https://notcve.org/view.php?id=CVE-2018-18623
02 Jun 2020 — Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099. Grafana versión 5.3.1, presenta una vulnerabilidad de tipo XSS por medio de la pantalla "Dashboard ) Text Panel". NOTA: este problema se presenta debido a una corrección incompleta para CVE-2018-12099. A flaw was found in grafana. • https://github.com/grafana/grafana/issues/15293 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13430 – grafana: XSS via the OpenTSDB datasource
https://notcve.org/view.php?id=CVE-2020-13430
24 May 2020 — Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. Grafana versiones anteriores a 7.0.0, permite un ataque de tipo XSS del valor de etiqueta por medio de la fuente de datos OpenTSDB. A flaw was found in grafana Tag value XSS via the OpenTSDB datasource are possible. The highest threat from this vulnerability is to data confidentiality and integrity. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise Ope... • https://github.com/grafana/grafana/pull/24539 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.2EPSS: 0%CPEs: 6EXPL: 1CVE-2020-12458 – grafana: information disclosure through world-readable /var/lib/grafana/grafana.db
https://notcve.org/view.php?id=CVE-2020-12458
29 Apr 2020 — An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted datasource passwords). Se encontró un fallo de divulgación de información en Grafana versiones hasta 6.7.3. El directorio de base de datos /var/lib/grafana y el archivo de base de datos /var/lib/grafana/grafana.db son de tipo world readable. • https://access.redhat.com/security/cve/CVE-2020-12458 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.2EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12459 – grafana: information disclosure through world-readable grafana configuration files
https://notcve.org/view.php?id=CVE-2020-12459
29 Apr 2020 — In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable. En determinados paquetes de Red Hat para Grafana versiones 6.x hasta 6.3.6, los archivos de configuración /etc/grafana/grafana.ini y /etc/grafana/ldap.toml (que contienen un secret_key y un bind_password) son de tipo world readable. An information-disclosure flaw was found in Grafana distributed by Red Hat.... • https://access.redhat.com/security/cve/CVE-2020-12459 • CWE-732: Incorrect Permission Assignment for Critical Resource •